password and salt are both labeled @JsonProperty, which takes precedence over the ignore on the setter and getter. I think if you remove the JsonPropety annotation (or replace it with JsonIgnore), those fields you want ignored will actually be ignored.